The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation and client script require the user to provide a raw Ethereum private key via the FITTINGS_PRIVATE_KEY environment variable. This key is used to sign blockchain transactions to pay for the API service. Storing private keys in plaintext environment variables is a sensitive operation in agentic environments where variables may be exposed or logged.
[EXTERNAL_DOWNLOADS]: The skill instructions (SKILL.md) direct the agent to download a helper script (call.mjs) from the vendor's domain (https://fittings.sh/skill/call.mjs) using curl if the file is not present locally.
[REMOTE_CODE_EXECUTION]: The call.mjs script performs dynamic loading of Node.js libraries, including @x402/fetch, @x402/evm, and viem. It also includes an integrity check that hashes the local script and compares it against a remote version served by the gateway, effectively requiring the local code to match the remote server's version to proceed.
[COMMAND_EXECUTION]: The skill relies on shell commands including curl for fetching configuration and code, and node for executing the client script to perform the candidate search.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests user-supplied candidate names (q) and external API responses (FEC candidate records) which are then processed by the agent. No active exploitation patterns were detected, and inputs are sanitized using encodeURIComponent before being used in network requests.

fec-candidate-search